Domain > kronosmd.com

More information on this domain is in AlienVault OTX

Files that talk to kronosmd.com

MD5	A/V
bb75fc7e33ae31074ea208965a43cb4a	[JS.eIframeDownloader.B609] [Trojan.JS.Nemucod.DB] [JS/Nemucod.oi] [JS/Locky.BD!Eldorado] [JS/TrojanDownloader.Nemucod.BDR] [JS_NEMUCOD.SMAA9] [Trojan.JS.Nemucod.DB] [Trojan.JS.Nemucod.DB] [Trojan.JS.Nemucod.DB] [JS.DownLoader.2430] [JS/Locky.BD!Eldorado] [Trojan.JS.Nemucod.DB] [Troj.Downloader.Script!c] [Trojan.JS.Nemucod.DB] [Js.Trojan.Raas.Auto] [Win32.SuspectCrc] [JS/Nemucod.BFBB!tr]
4244038dff13ba136edc1c5b60c2fb86	[JS.eIframeDownloader.4736] [JS/Locky.BD!Eldorado] [JS/TrojanDownloader.Nemucod.BDR] [JS_NEMUCOD.SMAA9] [Js.Trojan.Raas.Auto] [JS.DownLoader.2425] [JS/Locky.BD!Eldorado] [JS/Nemucod.oi] [Win32.SuspectCrc] [JS/Nemucod.BFBB!tr]
82a756c869ffa347d08b0b38b845b5f8	[JS.eIframeDownloader.1367] [JS/Locky.BD!Eldorado] [JS.Downloader] [JS/TrojanDownloader.Nemucod.BDR] [JS_NEMUCOD.SMAA9] [Troj.Downloader.Script!c] [Js.Trojan.Raas.Auto] [JS.DownLoader.2425] [JS/Locky.BD!Eldorado] [TrojanDownloader:JS/Swabfex.C] [JS/Nemucod.oi] [Win32.SuspectCrc] [JS/Nemucod.BFBB!tr]

DNS Resolutions

Date	IP Address
2024-11-11	172.67.212.219 (ClassC)
2024-12-28	104.21.45.95 (ClassC)
2025-03-30	172.67.182.186 (ClassC)
2025-05-09	104.21.80.1 (ClassC)
2025-06-02	104.21.32.1 (ClassC)
2025-07-16	104.21.64.1 (ClassC)
2025-08-04	104.21.48.1 (ClassC)
2025-08-16	104.21.16.1 (ClassC)
2025-09-02	104.21.112.1 (ClassC)
2026-01-11	104.21.32.38 (ClassC)

HTTP/1.1 200 OKDate: Mon, 13 May 2024 19:20:38 GMTContent-Type: text/html; charsetUTF-8Transfer-Encoding: chunkedConnection: keep-aliveCache-Control: max-age600Expires: Mon, 13 May 2024 19:30:39 GMTVa

!DOCTYPE html>html>head>title>Password Protected Site/title>style>                body {margin:0px;}                #custom_messaging_banner {background: #eb583c;padding: 7px 10px;color: white;border-bottom: solid 3px white;font-size:16px;position:relative;z-index:1;}                /style>/head>meta nameviewport contentwidthdevice-width,initial-scale1.0>					style>											html, body {							text-align: center;							height: 100%;						}						body { background: url(http://kronosmd.com/wp-content/plugins/hide-my-site/images/bg_dot.png) #d6d9e2; font-family:Arial;}						#form_wrap { background: url(http://kronosmd.com/wp-content/plugins/hide-my-site/images/login_bg.png) no-repeat;display: block;margin: 0px auto;height: 450px;width: 403px; position: relative;top: 50%;margin-top: -225px; }						#form_wrap inputtypetext, .enter_password {background: url(http://kronosmd.com/wp-content/plugins/hide-my-site/images/input_back.png) no-repeat; position: absolute;top: 159px;left: 50px;							border: 0px;							width: 313px;							padding-left: 50px;							font-size: 15px;							line-height: 15px;							padding-top: 9px;							height:62px;							color:rgb(85, 86, 90);							opacity:.8;						}						#form_wrap input:active, #form_wrap input:focus {outline:0;opacity:1;}						#form_wrap button {background: url(http://kronosmd.com/wp-content/plugins/hide-my-site/images/login_button.png) no-repeat top; width: 316px;							border: 0px;							height: 85px;							position: absolute;							top: 257px;							left: 43px;							cursor:pointer; opacity:.7;						}						#form_wrap button:hover {opacity:.8}						#form_wrap button:focus, #form_wrap button:active { opacity:1;}						#the_hint_wrap {position: absolute;top: 225px;color: white;left: 63px;width: 291px;text-shadow: 1px 1px 1px black;font-weight: normal;font-family: Arial;text-align: left;font-size: 14px;overflow: hidden;max-height: 33px;}						#the_hint_wrap div {display:inline-block;vertical-align: top;}						#the_hint_title {padding-right:5px;}						#the_hint {width: 183px;}

Port 443

HTTP/1.1 200 OKDate: Mon, 13 May 2024 19:20:39 GMTContent-Type: text/html; charsetUTF-8Transfer-Encoding: chunkedConnection: keep-aliveCache-Control: max-age600Expires: Mon, 13 May 2024 19:30:40 GMTVa

!DOCTYPE html>html>head>title>Password Protected Site/title>style>                body {margin:0px;}                #custom_messaging_banner {background: #eb583c;padding: 7px 10px;color: white;border-bottom: solid 3px white;font-size:16px;position:relative;z-index:1;}                /style>/head>meta nameviewport contentwidthdevice-width,initial-scale1.0>					style>											html, body {							text-align: center;							height: 100%;						}						body { background: url(https://kronosmd.com/wp-content/plugins/hide-my-site/images/bg_dot.png) #d6d9e2; font-family:Arial;}						#form_wrap { background: url(https://kronosmd.com/wp-content/plugins/hide-my-site/images/login_bg.png) no-repeat;display: block;margin: 0px auto;height: 450px;width: 403px; position: relative;top: 50%;margin-top: -225px; }						#form_wrap inputtypetext, .enter_password {background: url(https://kronosmd.com/wp-content/plugins/hide-my-site/images/input_back.png) no-repeat; position: absolute;top: 159px;left: 50px;							border: 0px;							width: 313px;							padding-left: 50px;							font-size: 15px;							line-height: 15px;							padding-top: 9px;							height:62px;							color:rgb(85, 86, 90);							opacity:.8;						}						#form_wrap input:active, #form_wrap input:focus {outline:0;opacity:1;}						#form_wrap button {background: url(https://kronosmd.com/wp-content/plugins/hide-my-site/images/login_button.png) no-repeat top; width: 316px;							border: 0px;							height: 85px;							position: absolute;							top: 257px;							left: 43px;							cursor:pointer; opacity:.7;						}						#form_wrap button:hover {opacity:.8}						#form_wrap button:focus, #form_wrap button:active { opacity:1;}						#the_hint_wrap {position: absolute;top: 225px;color: white;left: 63px;width: 291px;text-shadow: 1px 1px 1px black;font-weight: normal;font-family: Arial;text-align: left;font-size: 14px;overflow: hidden;max-height: 33px;}						#the_hint_wrap div {display:inline-block;vertical-align: top;}						#the_hint_title {padding-right:5px;}						#the_hint {width: 183px;}

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]

Domain > kronosmd.com

Is this malicious?

Files that talk to kronosmd.com

DNS Resolutions

Port 80

Port 443